bugGNU GRUB - Bugs: bug #50809, Require signed Git commits


You are not allowed to post comments on this tracker with your current authentication level.

bug #50809: Require signed Git commits

Submitted by:  Sam Kuper <sampablokuper>
Submitted on:  Sat 15 Apr 2017 10:53:59 PM UTC  
Category: SecuritySeverity: Major
Priority: 5 - NormalItem Group: Action Request
Status: NonePrivacy: Public
Assigned to: NoneOriginator Name: 
Open/Closed: OpenRelease: 
Release: Git masterReproducibility: Every Time
Planned Release: None

Sat 15 Apr 2017 10:53:59 PM UTC, original submission:

None of GRUB's Git commits have been signed:

$ git log --pretty="format:%G?" | grep -v 'N$'

This exposes GRUB to tampering. See: https://mikegerwitz.com/papers/git-horror-story

GRUB should implement a Git hook to prevent unsigned commits being committed to the Savannah-hosted master branch or to Savannah-hosted tags.

(By "Savannah-hosted", I mean "hosted at savannah.gnu.org".)

Sam Kuper <sampablokuper>


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by sampablokuper (Submitted the item)

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    No Changes Have Been Made to This Item

    Back to the top

    Powered by Savane 3.1-cleanup1